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Abstract — In this paper, the probability of Eve the Eavesdrop- 
per's correct decision is considered both in the Gaussian and 
Rayleigh fading wiretap channels when using lattice codes for 
the transmission. 

First, it is proved that the secrecy function determining Eve's 
performance attains its maximum at y = 1 on all known extremal 
even unimodular lattices. This is a special case of a conjecture 
by Belflore and Sole. Further, a very simple method to verify or 
disprove the conjecture on any given unimodular lattice is given. 

Second, preliminary analysis on the behavior of Eve's prob- 
ability of correct decision in the fast fading wiretap channel 
is provided. More specifically, we compute the truncated inverse 
norm power sum factors in Eve's probability expression. The anal- 
ysis reveals a performance-secrecy-complexity tradeoff: relaxing 
on the legitimate user's performance can significantly increase 
the security of transmission. The confusion experienced by the 
eavesdropper may be further increased by using skewed lattices, 
but at the cost of increased complexity. 

I. Introduction 

The first part of the paper is related to the Gaussian wiretap 
channel 0, 0, 0, |4j. Belflore and Oggier defined in [4] 
the secrecy gain 

max , 
ym,o< y QA(yi) 

where 

e A (z) = ^e™n*n 2z , 

as a new lattice invariant to measure how much confusion 
the eavesdropper will experience while the lattice A is used 
in Gaussian wiretap coding. The function Sa(j/) = ^Q^iyi) * s 
called the secrecy function. Belflore and Sole then conjectured 
in that the secrecy function attains its maximum at y = 1, 
which would then be the value of the secrecy gain. The secrecy 
gain was further studied by Oggier, Sole and Belflore in 0. 

The main point of this part of the paper is to prove the 
following theorem: 

Theorem 1.1: The secrecy function obtains its maximum at 
y = 1 on all known even unimodular extremal lattices. 
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Further, the method used here applies for any given even 
unimodular (and also for some unimodular but not even) 
lattices. This will be discussed in its own section. 

In the second part of the paper, we move from Gaussian 
wiretap channels on to Rayleigh fading wiretap channels. Our 
attempt is to increase the understanding of the performance of 
wiretap lattice codes through a numerical analysis on the prob- 
ability of Eve the Eavesdropper's correct decision. To this end, 
we provide the first explicit lattice code consttuctions based 
on algebraic number fields K and the canonical embedding of 
their rings of integers Ok or an ideal I C Ok, as suggested in 
0, and then compute the truncated inverse norm power sum 
factors in Eve's probability expression. The study concentrates 
on the special case of totally real number field extensions 
to guarantee full diversity 0, with three explicit example 
codes arising from both orthogonal and skewed lattices that 
are subsets in K 4 . The results indicate a performance-secrecy- 
complexity tradeoff: relaxing on the legitimate user's perfor- 
mance can significantly increase the security of ttansmission. 
The confusion experienced by the eavesdropper may be further 
increased by using skewed lattices, but at the cost of increased 
complexity. 

We assume the fading is Rayleigh disttibuted. Due to lack 
of space, we do not repeat the channel model nor the detailed 
transmission scheme here, but refer to for more details. 

II. Preliminaries and Definitions 

Let us first recall the notion of a lattice as they will play a 
key role throughout the paper. For our purposes, a lattice A is 
a discrete abelian subgroup of a real vector space, 

A = Zft © Zft • • ■ © Z(3 K C M" , 

where the elements ft.,... , ftr are linearly independent, i.e., 
form a lattice basis, and K < n is called the rank of the 
lattice. Here, we only consider full rank totally real lattices, 
that is, we set K = n and will always have ft g R. 

The Gram matrix of a lattice is defined as G(A) = 
(Tr(ftft T ))i<ij< n = MM T , where M is the generator 
matrix of the lattice. The determinant of the Gram matrix is 
also called lattice determinant. The volume of the fundamental 
parallelotope of the lattice is Vol(A) = x /det(G(A)) = 
|det(M)|. 

Definition 2.1: The minimum product distance of a lat- 
tice A is dp, m i„(A) = mirio^xeA IlLi where x = 
(xi,...,x n ) e A. 



Remark 2.1 : In order to fairly compare different lattices, 
we first normalize them to a unit volume Vol(A) = 1 and 
then compute the (normalized) minimum product distance 

A lattice is called unimodular if its determinant = ±1, and 
the norms are integral, i.e., ||x|| 2 G Z for all vectors x in the 
lattice. Further, it is called even, if ||x|| 2 is even. Otherwise 
it is called odd. A lattice can be even unimodular only if the 
dimension is divisible by 8. Odd unimodular lattices have no 
such restrictions. 

Definition 2.2: Write n = 24m + 8k, where k € 
{0, 1, 2}. An even unimodular lattice is called extremal if the 
norm of the shortest vector in the lattice is 2m + 2. 

It is worth noticing that the definition of extremal has 
changed. Earlier (see e.g. [7 1), extremal meant that the shortest 
vector was of length [£| + 1. With the earlier definition the 
highest dimensional self-dual extremal lattice is in dimension 
24 (see Q), while with the current definition there is a selfdual 
extremal lattice in dimension 80 (for a construction, see [8|). 



i9 ■& 

function can be written as a simple rational function of 



e 



3=1 



$4^4 \ 3(m-j) + fc 



(1) 



Hence, finding the maximum of the secrecy function is equiva- 
lent to finding the minimum of the denominator of the previous 
expression in the range of — Ir 1 . 

Let us now turn to general unimodular lattices, in particular 
odd ones. Write now n = 8/i + v, where n is the dimension 
of the lattice. Just like a bit earlier, the theta function of any 
unimodular lattice (regardless of whether it's even or odd), can 
be written as a polynomial (see e.g. (3) in 171): 



III. On the conjecture by Belfiore and Sole in the 
Gaussian wiretap channel 

Let us first have a closer look at theta-functions. For an 
excellent source on theta-functions, see e.g. Chapter 10 in 
Stein's and Shakarchi's book J9). 



A. On theta functions 

A theta function for a lattice A is defined as follows: 

In the following, we will need functions $2, $3 and ^4, 
which are defined in the following way: 

00 

Mr) = e^/ 4 [] (1 q 2n )(l + q 2n )(l + g 2 "" 2 ) 



tf 3 (T)=n(i-? 2 ")(i 

71=1 
OO 



2n-l\2 



„2n-l\2 



Let us now have a brief look at the even unimodular lattices. 
Write again n = 24m + 8k. Then the theta function of 
the lattice can be written as a polynomial of the Eisenstein 
series E± and the discriminant function A: = ij| m+fc + 

E^Li & ^ 3(m " j)+fcAJ - Since E ± = 5(^2 + ^3 + ^4) and 

^ = 256^2^1^4' the theta function of an even unimodular 
lattice can be easily written as a polynomial of these basic 
theta functions. Furthermore, since d\ + d\ = the secrecy 



0a = a r ^ 3 



n—8r 



A r 



where As = xg^t^t- Hence 



Hi 



\r=0 6 



(2) 



Again, to determine the maximum of the function, it suffices 



to consider the denominator polynomial in the range of ^ >A 



B. Lemmas 

The following lemma is easy, and follows from the basic 
properties of theta functions. The proof will be omitted. 

Lemma 3.1: Let y G R. The function f(y) = ^$^ vi) 
has symmetry: f(y) = f (l/y). 

We may now formulate a lemma that is crucial in the proof 
of the main theorem: 

Lemma 3.2: Let y e R. The function attains its 

maximum when y = 1. This maximum is 4. 

Proof: To shorten the notation, write g = er^ v . Notice 
that when y increases, g decreases and vice versa. Using the 
product representations for the functions #2(2/*), $3(yi) and 
•diiyi), we obtain 



~^m^ =9 n (1+5 )(1 



,2n-2\ 



vn=l 



Now 



J](l+.9 2 - 2 ) = 2n(l+.9 2 ") 



n=l 



and 



no 



= na+* 2n ) hid 

\n=l / \n=l 

Combining all these pieces together, we obtain 



2n-l\ 



My*) 2 



= 2 UV*JI (! + (-,)' 



Since the factor 2 is just a constant, it suffices to consider the 
function J^n^il 1 + To find the 

maximum, let 

us first differentiate the function: 



d 



n=l 



\ n—1 / \ n—1 



n(-l)V 



(-5)" 



Since g 1 / 24 n^Li(l + ( — flO n ) i s always positive, it suffices to 

analyze the part ^T+r^v^ to find tne maxima. 

We wish to prove that the derivate has only one zero, because 
if it has only one zero, then this zero has to be located at y = 1 
(because the original function has symmetry, and therefore, a 
zero in the point y results in a zero in the point i which has to 
be separate unless y — 1). To show that the derivative has only 
one zero, let us consider the second derivative, or actually, the 
derivative of the part ^ + S^Li " l^H-g)' 1 • Now 




(-5)" J 
n(n - l)(-l) n g n - 2 



n 2 g 2(n-l) 

(i + {-g) n f 



Now we wish to show that this is negative when g £ (0,1). 
Let us first look at the term — 777-2- and the terms in the sum 
corresponding the values n = 1 and n = 2. Their sum is 



1 



1 



2 5 2 



24. 9 2 



-73g 6 + 98g 5 - big 



2)2 



92g 3 + 21g 2 +2g-l 



The denominator is positive when g € (0, 1), and the nomina- 
tor has two real roots, which are both negative (approximately 
gi « -0.719566 and g 2 « -0.196021). On positive values 
of g, the nominator is always negative. In particular, the 
nominator is negative when g 6 (0, 1). 

Let us now consider the terms n > 2, and show that the sum 
is negative. Since the original function has symmetry y — > -, 
and we are only considering the real values of the theta series, 
we may now limit ourselves to the interval y E [1, oo), which 
means that g g (0, e _7r ]. Let us now show that the sum of 



two consecutive terms where the first one corresponds an odd 
value of n, and the second one an even value of n is negative. 
The sum looks like the following: 



n(n — l)g" 
1-ff™ 



ii 



2 ff 2(«-i) „( n + iy»-i ( n + l)V 



(l-5 n ) a 



1 + g n+1 



(1 + .g»+ 1 ) 2 ' 



Let us estimate this, and take a common factor: 

1 ng n 



< 9 n ' 2 n 



n 



9 n (1 
in + 1)5 
1 



9 
n 



n+l 



1 



- 9 n ) 2 
(n_+ l)g r 

(1 

~9 n 



-,n+l\2 



(1 



f 

(n + i)g 

~Tl+l\2 



(1 



< 9 n ' 2 n 



-(n-1)- g n + (n + l)g 



<o, 



(1 + ff> 

when (n — 1) + .g™ > (n + l)g. Since (n — 1) + ,g™ > (n — 1), 
and (n + l)s < (n+ l)e _7r < 2±1 < n - 1, when n > 2, this 
proves that the first derivative has only one zero. This zero 
is at y = 1. Since the second derivative is negative, it means 
that this point is actually the maximum of the function. The 
maximum value is Q8 Vt 



V 



C. Proof of the main theorem 

Let us first deal with the lattice E% as a warm-up case. We 
wish to show that 

Theorem 3.3: Se 8 (?/) < Ss g (l). 
Proof: Notice that 



^E 8 (y) = ( - 



^(yif 



Therefore, to show that Theorem 13.31 holds, it suffices to 

i?2(») 4 i?4(»r 



, which is equivalent to 
which we have already 



show that y < 

showing that M f^lr ] 

done in Lemma [3721 ■ 
Let us now concentrate on the other cases. Again, write 
z = ^f 1 - The following table gives the secrecy functions 
of all known extremal even unimodular lattices (notice that 
these are known only in dimensions 8 — 80): 



dimension 




S 




(!-,)-! 




16 




((I-,) 2 )" 1 




24 




((!--)» -ft.")" 1 




32 




((l-,) 4 -M (1 _^2)-i 




40 




((l-,) 5 -2| (1 _, ) 2 ;I 2)-l 




48 




-■,6 45 n ,>3,2 , 3915 ,4 s ! -1 
z ' 8~ l ' + 2048 I 




56 


((I-*) 7 


105 n .4 2 ,21735 ,, ,,,4\-l 




64 


(<1-*> S 


-^(i-lV + gd-.jV)- 1 




72 


(d - *) 9 - W 


M ,i6.2 i 60345 n ,,3,4 53325 ,6 "| 
1 ' + 4096 1 ' 32768 J 


-1 


80 


( ( i_,)io_^p (1 _ 


,\7 2 i 42525 i -i ,,4,4 202125 , , 

-J ~ + 2048 ( ~ ; 3276fi ^ J 





It suffices to show that the first derivatives of the denominators 
are negative because then the denominator is decreasing, and 
the function is increasing and obtains its maximum at z = \. 



It is a straightforward calculation to show this. For some 
details, see iflOl . 



D. Method for any given unimodular lattice 

Let A be a unimodular lattice. Then its secrecy function 
can be written as a polynomial P(z), where z = — as 
shown in (Q~|i and (0. Now, according to Lemma I3.21 < 
z < j (the lower bound does not follow from the lemma but 
from the fact that z is a square of a real number). Therefore, 
it suffices to consider the polynomial P(z) on the interval 
[0,4]. The conjecture is true if and only if the polynomial 
obtains its smallest value on the interval at 4. Investigating the 
behaviour of a given polynomial to show whether one point 
is its minimum on a short interval is a very straightforward 
operation. 

IV. On the size of Eve's inverse norm power sum in 

A FAST RAYLEIGH FADING WIRETAP CHANNEL 

Let us now look at the Rayleigh fading wiretap channel and 
analyze the behavior of the probability for Eve's correct deci- 
sion in some example cases. This will give us a preliminary 
understanding as to what are the key properties affecting the 
secrecy gained by lattice coding. 

A. The probability expression and the inverse norm power sum 

We start by recalling the expression P Cje for the probability 
of a correct decision for Eve, when observing a lattice A e . For 
the fast fading case [5, Sec.III-A], 



1 

4^1 



n/2 



Vol(A 6 ) 



E 



- i 

n u~t 



(3) 



0/xeA e i=l 



where ~f e is the average SNR for Eve assumed sufficiently 
large so that Eve can perfectly decode A e . Here At denotes 
the lattice intended for Bob, and A e c A&. It can be concluded 
from (01 that the smaller the sum X)o#xeA c 11™= i j^Tp > ^ e 
more confusion Eve is experiencing. 

As a construction method, the authors of |2] propose to 
use the canonical embedding of the ring of integers Ok (or 
a suitable proper ideal 1 C Ok) of a number field K over 
Q. The field K is chosen totally real to achieve full diversity. 
More precisely, if x £ Ok, the transmitted lattice vector in 
the fast fading case would be 



(a x (x),a 2 (x),...,a n (x)) £ O k = A e 



(4) 



where cr, are the (now all real) embeddings of K into C. The 
corresponding probability for Eve's correct decision OJ yields 
the following inverse norm power sum to be minimized |j5] 
Sec.III-B]: 



Sm = 



(5) 



where M denotes the generator matrix of the lattice A e . 

Remark 4.1 : The infinite sums above do not necessarily 
converge. In practice, however, the sum will always be trun- 
cated as x £ C C A e , where the code C is finite. 



B. Example constructions and analysis on the sum Sm 

In this section, we describe three alternative constructions 
for the fast fading channel built from different number fields 
and their ideals. Optimal and nearly optimal unitary lattice 
generator matrices in terms of the minimum product distance 
(cf. Def. 12. It are provided in IfTTI . We will analyze the ones 
with degree n = 4, denoted here by Ai and A 2 , with the 
respective unitary (i.e., MM T — I 4 ) generator matrices Mi 
( IfTTI optimal, Mi = krus_4 ]) and M 2 (IUJ suboptimal, 
Mi = mixcd_2x2]). The first construction is based on the 
Kronecker product of the lattice generator matrices corre- 
sponding to the canonical embeddings of the rotated Z 2 lattices 
aiZ[\/2] and a 2 Z[9], where 9 = 1± ^, a x = and 
a 2 = 3 — The second construction corresponds to the 
canonical embedding of Oq/g), where S 4 — S 3 — 3S 2 +5+l = 0. 
Both lattices are rotated versions of Z 4 with full diversity and 
good minimum product distances, dp, m j n (Ai) = ^ 5 l 29 ~ 
0.037139... and d p>min (Ai) = i 0.025. We use finite 
constellations S m constructed by taking a square box with a 
zero mean within the lattice, i.e., 



xe5„ 



ZiXi 



m > Zi G Z > c A e 



Let us now compare these two (finite) orthogonal constructions 
by computing truncated sums 

1 



SM(Plim,m) 



E 

o#xeA e n5 m ,||x|||,<Pi i7 , 



Wk/q(xW 



(6) 



for a given power limit Pn m and for a given finite con- 
stellation S m . In the above sum, x = (xi,...,x n ) = 
(a\(x), (Ji{x), . . . , a n (x)), where x £ Ok or x £ X C Ok- 
For a fair comparison, the lattices are normalized to unit 
energy, i.e., to have Vol(A e ) = 1. The volumes of the corre- 
sponding superlattices A& of Bob will then scale accordingly. 

In Table I we have listed the inverse norm power sums for 
fixed constellations without limiting the energy, that is, the 
codebook will be of size \C or t\ — (2m + l) 4 . The maximum 
energies P max used by the constellations are also provided. 

From Table I we can make the following important conclu- 
sion. In terms of the pair-wise error probability (PEP) for Bob 
as the intended legitimate receiver, the optimal lattice is known 
to provide (at least asymptotically) the best performance. 
However, from the secrecy point of view the suboptimal lattice 
may provide significantly improved secrecy by causing more 
confusion to the eavesdropper Eve. This is due to a secondary 
code design criterion related to maximizing the norms of the 
code vectors (usually showing its PEP effect at the low SNR 
regime), which obviously plays an important role also in the 
wiretap scenario (cf. Q). 

Next, we extend our analysis by computing the inverse norm 
power sums for a skewed lattice, denoted by A3, corresponding 
to the maximal real subfield of the 15th cyclotomic field. The 
generator matrix is denoted by M3. The minimum product 



distance of this lattice is cL 



*(A 3 ) 



0.02981. 



putting it in between the lattices Ai and A2 in terms of 
rfp,min(A). From Table II, we can conclude that skewed 
lattices may significantly increase the secrecy compared to 
orthogonal lattices. One has to notice, however, that this 
bares the price of increased complexity as we need to carve 
spherical codebooks by using a bigger alphabet in order to 
get the possible benefits. More precisely, we only choose the 
codewords in the set {x e A e fl <S m | ||a;|||, < Pu m }. Hence, 
in order to achieve the same size of a codebook that we would 
have without an energy limit, we may need to increase m (see 
e.g. the boldface lines in Table II). The bigger the m, the closer 
we get to a spherical constellation with a given energy limit. 

TABLE I 

Values of S M (Pum = °°, m) for orthogonal lattices without 

AN ADDITIONAL ENERGY LIMIT AND WITH A CODEBOOK SIZE 
\C ort \ = (2m + l) 4 . 



m 


Pmax 


Pave 


SM 1 {Pu m ,m) 


SM 2 (Piim,m) 


1 


4 


2.67 


9.12264 ■ 


10 v 


2.83706 ■ 


10° 


2 


16 


8.00 


2.24565 ■ 


10 10 


6.46037 ■ 


10 6 


3 


36 


16.00 


2.49382 


10 11 


1.16395 


10 7 


4 


64 


26.67 


2.49829 ■ 


10 11 


1.52838 ■ 


10 7 


5 


100 


40.00 


2.49851 ■ 


10 11 


1.99487 ■ 


10 7 


6 


144 


56.00 


2.50437 ■ 


10 11 


2.38188 ■ 


10 7 


7 


196 


74.67 


2.61395 ■ 


10 11 


2.69652 ■ 


10 7 


8 


256 


96.00 


2.61736 • 


10 11 


3.00791 • 


10 7 


9 


324 


120.00 


2.61739 • 


10 11 


3.42272 ■ 


10 7 


10 


400 


146.67 


2.71764 ■ 


10 11 


3.68287 ■ 


10 7 



TABLE II 

VALUES OF SM{Plim,rn) FOR A SKEWED LATTICE WITH BOUNDED 
ENERGY. 



TCI 






Pave 


\C sp h\ 


\C OTt \ 


Sm A [Plim 


, m) 


8 


4 


3.63 


2.66 


79 


81 


1.89195 


10° 


5 


16 


15.71 


9.18 


555 


625 


4.24298 


10 6 


6 


16 


15.71 


9.56 


715 


625 


4.77423 


10 6 


7 


36 


35.57 


20.33 


2405 


2401 


7.13024 • 


10 8 


12 


36 


24.00 


15.24 


2401 


2401 


2.29374 


10 8 


9 


64 


63.89 


35.67 


6929 


6561 


9.93903 


10 6 


10 


100 


99.97 


55.72 


13663 


14641 


1.20680 


10 7 


11 


100 


99.97 


55.57 


16053 


14641 


1.29038 


10 7 


14 


196 


195.98 


106.63 


50975 


50625 


1.29038 


10 7 


18 


324 


323.93 


175.95 


137273 


130321 


2.18703 


10 7 


20 


400 


399.90 


217.31 


208411 


194481 


2.40716 


10 7 



Note that we have normalized the lattices to a unit volume 
(corresponding to a unit minimum energy in the orthogonal 
case), whereas to compare the full probability expressions (01 
we should normalize the SNR term rather with respect to 
a unit average energy. For comparison purposes, this makes 
no difference for orthogonal lattices as the average energies 
are directly determined by the signaling alphabet and not 
affected by the generator matrices, so the scaling factors will 
coincide. However, in the case of skewed lattices the situation 
is different, and the average energy has an input coming 
from the generator matrix in addition to the alphabet. This 
may loosen our conclusion related to skewed lattices to some 
extend. Due to lack of time, we studied this effect here only for 
the case of maximum energy/energy limit 36 (see the boldface 
lines in Table I and Table II). We can see that the skewed lattice 



can achieve even better energy distribution than the orthogonal 
ones, when m is chosen sufficiently large. Unfortunately, the 
bigger the m, the higher the complexity. Further analysis is 
clearly required and planned to be carried out by the final 
submission of this paper. Due to lack of space, we were also 
forced to omit the corresponding analysis on the block fading 
channel. This will be reported in near future. 

V. Conclusions 

We analyzed the probability of Eve the Eavesdropper's 
correct decision in a wiretap channel. In the case of a Gaussian 
wiretap channel, we proved the Belfiore-Sole conjecture for 
all known even unimodular extremal lattices, and gave a 
method to prove or disprove it on any given unimodular 
lattice. In the case of a Rayleigh fading wiretap channel, 
we computed truncated values of the inverse norm power 
sum and compared three different lattices. The comparison 
resulted in an interesting conclusion: slightly relaxing on Bob's 
optimal performance can significantly increase the secrecy of 
the transmission. Further reliability can be achieved by using a 
skewed lattice, but at the cost of increased complexity. Hence, 
there is clearly a performance-secrecy-complexity tradeoff 
aiding the service provider's subjective choice for a suitable 
transmission scheme. 
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